Skip to content

CVE · Exploited · On CISA KEV

CVE-2025-14847

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

8.7
CVSS 4.0
1
story
DEC 29
added to KEV
Severity
8.7 High · vendor score
Vendor
MongoDB
Product
MongoDB and MongoDB Server
Published
Dec 19, 2025
Added to KEV
Dec 29, 2025
KEV deadline
Jan 19, 2026
Ransomware use
Unknown
Weakness
CWE-130

What it is

MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesSerious MongoDB Flaw CVE-2025-14847 Under ExploitationMongoDB disclosed the vulnerability (CVE-2025-14847) on Dec. 19 and a few days later, a public exploit for it appeared online.DENNIS FISHER · 1 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixjira.mongodb.org/browse/SERVER-115508Analysissmartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847Exploitvicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-serverExploitvicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server